CVE-2026-15691 is a stack-based buffer overflow vulnerability affecting Tenda BE12 Pro firmware version 16.03.66.23. The issue arises from improper handling of the page argument in the fromSafeClientFilter function located in /goform/SafeClientFilter. An attacker can remotely exploit this flaw to cause a buffer overflow condition. Public exploit code is available, increasing the risk of exploitation. No official patch or remediation has been confirmed as of the published date.

Successful exploitation of this vulnerability could allow a remote attacker to cause a stack-based buffer overflow, potentially leading to arbitrary code execution or denial of service on the affected device. Given the high CVSS score (8.7) and the availability of public exploit code, the risk to affected systems is significant.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict remote access to the affected device and monitor for suspicious activity related to the /goform/SafeClientFilter endpoint. Avoid exposing the device management interface to untrusted networks.